@portaidentity/server 1.7.0

package/dist/routes/bulk.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Bulk operations API routes.
+ *
+ * Provides endpoints for performing bulk status changes on organizations
+ * and users. Designed for admin UI batch operations.
+ *
+ * Route structure:
+ *   POST /api/admin/bulk/organizations/status — Bulk org status change
+ *   POST /api/admin/bulk/users/status         — Bulk user status change
+ *
+ * @see 06-bulk-operations-branding.md
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+export declare const bulkOrgStatusSchema: z.ZodObject<{
+    ids: z.ZodArray<z.ZodString>;
+    action: z.ZodEnum<{
+        activate: "activate";
+        archive: "archive";
+        suspend: "suspend";
+    }>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const bulkUserStatusSchema: z.ZodObject<{
+    ids: z.ZodArray<z.ZodString>;
+    action: z.ZodEnum<{
+        activate: "activate";
+        deactivate: "deactivate";
+        lock: "lock";
+        suspend: "suspend";
+        unlock: "unlock";
+    }>;
+    reason: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodString;
+}, z.core.$strip>;
+export declare function createBulkRouter(): Router;
+//# sourceMappingURL=bulk.d.ts.map

package/dist/routes/bulk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bulk.d.ts","sourceRoot":"","sources":["../../src/routes/bulk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,mBAAmB;;;;;;;;iBAU9B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;iBAW/B,CAAC;AAMH,wBAAgB,gBAAgB,IAAI,MAAM,CAqDzC"}

package/dist/routes/bulk.js

@@ -0,0 +1,94 @@
+/**
+ * Bulk operations API routes.
+ *
+ * Provides endpoints for performing bulk status changes on organizations
+ * and users. Designed for admin UI batch operations.
+ *
+ * Route structure:
+ *   POST /api/admin/bulk/organizations/status — Bulk org status change
+ *   POST /api/admin/bulk/users/status         — Bulk user status change
+ *
+ * @see 06-bulk-operations-branding.md
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { bulkStatusChange } from '../lib/bulk-operations.js';
+// ---------------------------------------------------------------------------
+// Validation schemas
+// ---------------------------------------------------------------------------
+export const bulkOrgStatusSchema = z.object({
+    ids: z
+        .array(z.string().uuid())
+        .min(1)
+        .max(100)
+        .refine((ids) => new Set(ids).size === ids.length, {
+        message: 'Bulk entity identifiers must be unique',
+    }),
+    action: z.enum(['activate', 'suspend', 'archive']),
+    reason: z.string().max(500).optional(),
+});
+export const bulkUserStatusSchema = z.object({
+    ids: z
+        .array(z.string().uuid())
+        .min(1)
+        .max(100)
+        .refine((ids) => new Set(ids).size === ids.length, {
+        message: 'Bulk entity identifiers must be unique',
+    }),
+    action: z.enum(['activate', 'deactivate', 'suspend', 'lock', 'unlock']),
+    reason: z.string().max(500).optional(),
+    organizationId: z.string().uuid(),
+});
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+export function createBulkRouter() {
+    const router = new Router({ prefix: '/api/admin/bulk' });
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // POST /organizations/status — Bulk organization status change
+    // -------------------------------------------------------------------------
+    router.post('/organizations/status', requirePermission(ADMIN_PERMISSIONS.ORG_UPDATE), async (ctx) => {
+        const parsed = bulkOrgStatusSchema.safeParse(ctx.request.body);
+        if (!parsed.success) {
+            ctx.status = 400;
+            ctx.body = { error: 'Bulk request is invalid', code: 'bulk_request_invalid' };
+            return;
+        }
+        const body = parsed.data;
+        const result = await bulkStatusChange({
+            entityType: 'organization',
+            entityIds: body.ids,
+            action: body.action,
+            reason: body.reason,
+            actorId: ctx.state.adminUser?.id,
+        });
+        ctx.body = result;
+    });
+    // -------------------------------------------------------------------------
+    // POST /users/status — Bulk user status change
+    // -------------------------------------------------------------------------
+    router.post('/users/status', requirePermission(ADMIN_PERMISSIONS.USER_SUSPEND), async (ctx) => {
+        const parsed = bulkUserStatusSchema.safeParse(ctx.request.body);
+        if (!parsed.success) {
+            ctx.status = 400;
+            ctx.body = { error: 'Bulk request is invalid', code: 'bulk_request_invalid' };
+            return;
+        }
+        const body = parsed.data;
+        const result = await bulkStatusChange({
+            entityType: 'user',
+            entityIds: body.ids,
+            action: body.action,
+            reason: body.reason,
+            organizationId: body.organizationId,
+            actorId: ctx.state.adminUser?.id,
+        });
+        ctx.body = result;
+    });
+    return router;
+}
+//# sourceMappingURL=bulk.js.map

package/dist/routes/bulk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bulk.js","sourceRoot":"","sources":["../../src/routes/bulk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC;SACH,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE;QACjD,OAAO,EAAE,wCAAwC;KAClD,CAAC;IACJ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC;SACH,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE;QACjD,OAAO,EAAE,wCAAwC;KAClD,CAAC;IACJ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAClC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAEzD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAC/C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,UAAU,EAAE,cAAc;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;SACjC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,+CAA+C;IAC/C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5F,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;SACjC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/clients.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Client and secret management API routes.
+ *
+ * All routes are under `/api/admin/clients` and require
+ * admin authentication (Bearer JWT). Provides CRUD for clients,
+ * status lifecycle (activate, deactivate, revoke), and nested
+ * secret management (generate, list, revoke).
+ *
+ * Route structure:
+ *   POST   /                               — Create a new client
+ *   GET    /                               — List clients (paginated)
+ *   GET    /:id                            — Get client by ID
+ *   PUT    /:id                            — Update client
+ *   POST   /:id/revoke                     — Revoke client (permanent)
+ *   POST   /:id/activate                   — Activate client
+ *   POST   /:id/deactivate                 — Deactivate client
+ *   POST   /:id/secrets                    — Generate new secret
+ *   GET    /:id/secrets                    — List secrets (no hashes)
+ *   POST   /:id/secrets/:secretId/revoke   — Revoke a secret
+ *
+ * Error mapping:
+ *   ClientNotFoundError → 404
+ *   ClientValidationError → 400
+ *   ZodError → 400 with validation details
+ *
+ * Important response notes:
+ *   - POST / returns 201 with { data: { client, secret } }
+ *   - POST /:id/secrets returns 201 with plaintext + warning
+ *   - GET /:id/secrets never includes secret_hash
+ */
+import Router from '@koa/router';
+/**
+ * Create the client management router.
+ *
+ * All routes require admin authentication (Bearer JWT via requireAdminAuth).
+ * Provides full CRUD for clients, status lifecycle, and nested secret
+ * management.
+ *
+ * Prefix: /api/admin/clients
+ *
+ * @returns Configured Koa Router
+ */
+export declare function createClientRouter(): Router;
+//# sourceMappingURL=clients.d.ts.map

package/dist/routes/clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../src/routes/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAmKjC;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CA0L3C"}

package/dist/routes/clients.js

@@ -0,0 +1,353 @@
+/**
+ * Client and secret management API routes.
+ *
+ * All routes are under `/api/admin/clients` and require
+ * admin authentication (Bearer JWT). Provides CRUD for clients,
+ * status lifecycle (activate, deactivate, revoke), and nested
+ * secret management (generate, list, revoke).
+ *
+ * Route structure:
+ *   POST   /                               — Create a new client
+ *   GET    /                               — List clients (paginated)
+ *   GET    /:id                            — Get client by ID
+ *   PUT    /:id                            — Update client
+ *   POST   /:id/revoke                     — Revoke client (permanent)
+ *   POST   /:id/activate                   — Activate client
+ *   POST   /:id/deactivate                 — Deactivate client
+ *   POST   /:id/secrets                    — Generate new secret
+ *   GET    /:id/secrets                    — List secrets (no hashes)
+ *   POST   /:id/secrets/:secretId/revoke   — Revoke a secret
+ *
+ * Error mapping:
+ *   ClientNotFoundError → 404
+ *   ClientValidationError → 400
+ *   ZodError → 400 with validation details
+ *
+ * Important response notes:
+ *   - POST / returns 201 with { data: { client, secret } }
+ *   - POST /:id/secrets returns 201 with plaintext + warning
+ *   - GET /:id/secrets never includes secret_hash
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import * as clientService from '../clients/service.js';
+import * as secretService from '../clients/secret-service.js';
+import { ClientNotFoundError, ClientValidationError } from '../clients/errors.js';
+import * as organizationService from '../organizations/service.js';
+import { LOGIN_METHODS } from '../clients/types.js';
+import { resolveLoginMethods } from '../clients/resolve-login-methods.js';
+import { setETagHeader, checkIfMatch } from '../lib/etag.js';
+import { getEntityHistory } from '../lib/entity-history.js';
+// ---------------------------------------------------------------------------
+// Validation schemas
+// ---------------------------------------------------------------------------
+/**
+ * Login method Zod schema — single source of truth for HTTP payload validation.
+ * Uses the runtime `LOGIN_METHODS` const so adding a new method only requires
+ * updating the union in `src/clients/types.ts`.
+ */
+const loginMethodSchema = z.enum(LOGIN_METHODS);
+/**
+ * Client-level login methods — three-state semantics at the HTTP boundary:
+ *   - field omitted → undefined  (leave unchanged / use DB default on create)
+ *   - `null`         → clear override, inherit org default
+ *   - non-empty array → explicit override
+ *
+ * `.min(1)` rejects empty arrays (service layer also rejects but the 400
+ * carries a useful validation message). `.nullable().optional()` allows
+ * both `null` and absence.
+ */
+const clientLoginMethodsSchema = z.array(loginMethodSchema).min(1).nullable();
+/** Schema for creating a new client */
+const createClientSchema = z.object({
+    organizationId: z.string().uuid(),
+    applicationId: z.string().uuid(),
+    clientName: z.string().min(1).max(255),
+    clientType: z.enum(['confidential', 'public']),
+    applicationType: z.enum(['web', 'native', 'spa']),
+    redirectUris: z.array(z.string().url()).min(1).max(10),
+    postLogoutRedirectUris: z.array(z.string().url()).max(10).optional(),
+    grantTypes: z.array(z.string()).optional(),
+    responseTypes: z.array(z.string()).optional(),
+    scope: z.string().optional(),
+    tokenEndpointAuthMethod: z.enum(['client_secret_basic', 'client_secret_post', 'none']).optional(),
+    allowedOrigins: z.array(z.string().url()).optional(),
+    requirePkce: z.boolean().optional(),
+    loginMethods: clientLoginMethodsSchema.optional(),
+    secretLabel: z.string().max(255).optional(),
+});
+/** Schema for updating a client (all fields optional) */
+const updateClientSchema = z.object({
+    clientName: z.string().min(1).max(255).optional(),
+    redirectUris: z.array(z.string().url()).min(1).max(10).optional(),
+    postLogoutRedirectUris: z.array(z.string().url()).max(10).optional(),
+    grantTypes: z.array(z.string()).optional(),
+    responseTypes: z.array(z.string()).optional(),
+    scope: z.string().optional(),
+    tokenEndpointAuthMethod: z.enum(['client_secret_basic', 'client_secret_post', 'none']).optional(),
+    allowedOrigins: z.array(z.string().url()).optional(),
+    requirePkce: z.boolean().optional(),
+    loginMethods: clientLoginMethodsSchema.optional(),
+});
+/** Schema for listing clients with pagination and filters */
+const listClientsSchema = z.object({
+    page: z.coerce.number().int().min(1).default(1),
+    pageSize: z.coerce.number().int().min(1).max(100).default(20),
+    organizationId: z.string().uuid().optional(),
+    applicationId: z.string().uuid().optional(),
+    status: z.enum(['active', 'inactive', 'revoked']).optional(),
+    search: z.string().max(255).optional(),
+    sortBy: z.enum(['client_name', 'created_at']).default('created_at'),
+    sortOrder: z.enum(['asc', 'desc']).default('desc'),
+});
+/** Schema for cursor-based listing (keyset pagination) */
+const listClientsCursorSchema = z.object({
+    cursor: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(100).default(25),
+    organizationId: z.string().uuid().optional(),
+    applicationId: z.string().uuid().optional(),
+    status: z.enum(['active', 'inactive', 'revoked']).optional(),
+    search: z.string().max(255).optional(),
+    sortBy: z.enum(['client_name', 'created_at']).default('created_at'),
+    sortOrder: z.enum(['asc', 'desc']).default('desc'),
+});
+/** Schema for generating a new secret */
+const createSecretSchema = z.object({
+    label: z.string().max(255).optional(),
+    expiresAt: z.coerce.date().optional(),
+});
+// ---------------------------------------------------------------------------
+// Response decoration helper
+// ---------------------------------------------------------------------------
+/**
+ * Attach the computed `effectiveLoginMethods` field to a client before
+ * returning it over HTTP.
+ *
+ * This is the public "resolved view" — API consumers get both the raw
+ * override (`loginMethods`, possibly `null`) and the effective array
+ * (`effectiveLoginMethods`, always non-empty) so they never have to replicate
+ * the inheritance rule on their side.
+ *
+ * The domain `Client` type is *not* widened to include `effectiveLoginMethods`
+ * — that field lives only on the API response, keeping the model a pure
+ * projection of the DB row.
+ *
+ * @param client - Client from the service layer
+ * @returns Client decorated with `effectiveLoginMethods`
+ */
+async function withEffectiveLoginMethods(client) {
+    const org = await organizationService.getOrganizationById(client.organizationId);
+    const effectiveLoginMethods = org
+        ? resolveLoginMethods(org, client)
+        : // Defensive: if the org went missing after the client was fetched, fall
+            // back to the client's explicit override if present, otherwise default.
+            (client.loginMethods ?? ['password', 'magic_link']);
+    return { ...client, effectiveLoginMethods };
+}
+// ---------------------------------------------------------------------------
+// Error handler helper
+// ---------------------------------------------------------------------------
+/**
+ * Handle domain errors and map them to HTTP responses.
+ * Unknown errors are re-thrown for the global error handler.
+ */
+function handleError(ctx, err) {
+    if (err instanceof ClientNotFoundError) {
+        ctx.throw(404, 'Client not found');
+    }
+    if (err instanceof ClientValidationError) {
+        ctx.throw(400, 'Client request is invalid');
+    }
+    if (err instanceof z.ZodError) {
+        ctx.status = 400;
+        ctx.body = { error: 'Client request is invalid' };
+        return undefined;
+    }
+    throw err;
+}
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the client management router.
+ *
+ * All routes require admin authentication (Bearer JWT via requireAdminAuth).
+ * Provides full CRUD for clients, status lifecycle, and nested secret
+ * management.
+ *
+ * Prefix: /api/admin/clients
+ *
+ * @returns Configured Koa Router
+ */
+export function createClientRouter() {
+    const router = new Router({ prefix: '/api/admin/clients' });
+    // All routes require admin authentication
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // POST / — Create client
+    // -------------------------------------------------------------------------
+    router.post('/', requirePermission(ADMIN_PERMISSIONS.CLIENT_CREATE), async (ctx) => {
+        try {
+            const body = createClientSchema.parse(ctx.request.body);
+            // Create client (returns ClientWithSecret — secret is null here)
+            const result = await clientService.createClient(body);
+            // For confidential clients, generate the initial secret automatically
+            let secret = result.secret;
+            if (body.clientType === 'confidential') {
+                secret = await secretService.generateAndStore(result.client.id, {
+                    label: body.secretLabel,
+                });
+            }
+            // Decorate the client with its resolved `effectiveLoginMethods` so
+            // API consumers get both the raw override and the effective value.
+            const decoratedClient = await withEffectiveLoginMethods(result.client);
+            ctx.status = 201;
+            ctx.body = {
+                data: { client: decoratedClient, secret },
+                ...(secret ? { warning: 'Store the secret securely. It will not be shown again.' } : {}),
+            };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET / — List clients (paginated)
+    // -------------------------------------------------------------------------
+    router.get('/', requirePermission(ADMIN_PERMISSIONS.CLIENT_READ), async (ctx) => {
+        try {
+            // Cursor-based pagination when `cursor` or `limit` param is present
+            if (ctx.query.cursor !== undefined || ctx.query.limit !== undefined) {
+                const query = listClientsCursorSchema.parse(ctx.query);
+                const result = await clientService.listClientsCursor(query);
+                ctx.body = result;
+                return;
+            }
+            // Default: offset-based pagination (backward compatible)
+            const query = listClientsSchema.parse(ctx.query);
+            const result = await clientService.listClientsByOrganization(query.organizationId ?? '', query);
+            ctx.body = result;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /:id — Get client by ID
+    // -------------------------------------------------------------------------
+    router.get('/:id', requirePermission(ADMIN_PERMISSIONS.CLIENT_READ), async (ctx) => {
+        const client = await clientService.getClientById(ctx.params.id);
+        if (!client) {
+            ctx.throw(404, 'Client not found');
+            return; // unreachable — keeps TS narrowing happy across the call boundary
+        }
+        setETagHeader(ctx, 'client', client.id, client.updatedAt);
+        ctx.body = { data: await withEffectiveLoginMethods(client) };
+    });
+    // -------------------------------------------------------------------------
+    // PUT /:id — Update client
+    // -------------------------------------------------------------------------
+    router.put('/:id', requirePermission(ADMIN_PERMISSIONS.CLIENT_UPDATE), async (ctx) => {
+        try {
+            const body = updateClientSchema.parse(ctx.request.body);
+            const current = await clientService.getClientById(ctx.params.id);
+            if (current && !checkIfMatch(ctx, 'client', current.id, current.updatedAt, current))
+                return;
+            const client = await clientService.updateClient(ctx.params.id, body);
+            setETagHeader(ctx, 'client', client.id, client.updatedAt);
+            ctx.body = { data: await withEffectiveLoginMethods(client) };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/revoke — Revoke client (permanent)
+    // -------------------------------------------------------------------------
+    router.post('/:id/revoke', requirePermission(ADMIN_PERMISSIONS.CLIENT_REVOKE), async (ctx) => {
+        try {
+            await clientService.revokeClient(ctx.params.id);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/activate — Activate client
+    // -------------------------------------------------------------------------
+    router.post('/:id/activate', requirePermission(ADMIN_PERMISSIONS.CLIENT_UPDATE), async (ctx) => {
+        try {
+            await clientService.activateClient(ctx.params.id);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/deactivate — Deactivate client
+    // -------------------------------------------------------------------------
+    router.post('/:id/deactivate', requirePermission(ADMIN_PERMISSIONS.CLIENT_UPDATE), async (ctx) => {
+        try {
+            await clientService.deactivateClient(ctx.params.id);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/secrets — Generate new secret
+    // -------------------------------------------------------------------------
+    router.post('/:id/secrets', requirePermission(ADMIN_PERMISSIONS.CLIENT_UPDATE), async (ctx) => {
+        try {
+            const body = createSecretSchema.parse(ctx.request.body);
+            const secret = await secretService.generateAndStore(ctx.params.id, body);
+            ctx.status = 201;
+            ctx.body = {
+                data: secret,
+                warning: 'Store the secret securely. It will not be shown again.',
+            };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /:id/secrets — List secrets (no hashes)
+    // -------------------------------------------------------------------------
+    router.get('/:id/secrets', requirePermission(ADMIN_PERMISSIONS.CLIENT_READ), async (ctx) => {
+        const secrets = await secretService.listByClient(ctx.params.id);
+        ctx.body = { data: secrets };
+    });
+    // -------------------------------------------------------------------------
+    // GET /:id/history — Client change history
+    // -------------------------------------------------------------------------
+    router.get('/:id/history', requirePermission(ADMIN_PERMISSIONS.CLIENT_READ), async (ctx) => {
+        const { limit, after, event_type } = ctx.query;
+        const result = await getEntityHistory('client', ctx.params.id, {
+            limit: limit ? parseInt(limit, 10) : undefined,
+            after: after || undefined,
+            eventTypePrefix: event_type || undefined,
+        });
+        ctx.body = result;
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/secrets/:secretId/revoke — Revoke a secret
+    // -------------------------------------------------------------------------
+    router.post('/:id/secrets/:secretId/revoke', requirePermission(ADMIN_PERMISSIONS.CLIENT_REVOKE), async (ctx) => {
+        try {
+            await secretService.revoke(ctx.params.secretId);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=clients.js.map

package/dist/routes/clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../../src/routes/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,aAAa,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,aAAa,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,mBAAmB,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE9E,uCAAuC;AACvC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC9C,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACjD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjE,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,yBAAyB,CACtC,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjF,MAAM,qBAAqB,GAAG,GAAG;QAC/B,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC;QAClC,CAAC,CAAC,wEAAwE;YACxE,wEAAwE;YACxE,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACxD,OAAO,EAAE,GAAG,MAAM,EAAE,qBAAqB,EAAE,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;QACzC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAClD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAE5D,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAExD,iEAAiE;YACjE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAEtD,sEAAsE;YACtE,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,IAAI,IAAI,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;gBACvC,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;oBAC9D,KAAK,EAAE,IAAI,CAAC,WAAW;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,eAAe,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEvE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;gBACzC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9E,IAAI,CAAC;YACH,oEAAoE;YACpE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACpE,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC5D,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,yDAAyD;YACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAC1D,KAAK,CAAC,cAAc,IAAI,EAAE,EAC1B,KAAK,CACN,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,8BAA8B;IAC9B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACnC,OAAO,CAAC,kEAAkE;QAC5E,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2BAA2B;IAC3B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;gBAAE,OAAO;YAC5F,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACrE,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1D,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,+CAA+C;IAC/C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uCAAuC;IACvC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7F,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2CAA2C;IAC3C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAClD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,0CAA0C;IAC1C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,wDAAwD;aAClE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,8CAA8C;IAC9C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2CAA2C;IAC3C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,KAA+B,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YAC7D,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9C,KAAK,EAAE,KAAK,IAAI,SAAS;YACzB,eAAe,EAAE,UAAU,IAAI,SAAS;SACzC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uDAAuD;IACvD,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,+BAA+B,EAC/B,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAClD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/config.d.ts

@@ -0,0 +1,35 @@
+/**
+ * System configuration admin API routes.
+ *
+ * All routes are under `/api/admin/config` and require admin
+ * authorization with granular permissions.
+ *
+ * Route structure:
+ *   GET    /                  — List all config entries
+ *   GET    /:key              — Get a specific config value
+ *   PUT    /:key              — Set (update) a config value
+ *
+ * Sensitive values (is_sensitive=true) are masked in GET responses
+ * with '***' to prevent accidental exposure in CLI output / logs.
+ *
+ * @module routes/config
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+/** Schema for updating a config value */
+export declare const updateConfigSchema: z.ZodObject<{
+    value: z.ZodString;
+}, z.core.$strip>;
+/** Return the only public representation allowed for a stored configuration value. */
+export declare function publicConfigValue(value: string, isSensitive: boolean): string;
+/**
+ * Create the system config admin API router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * Provides read and write access to the `system_config` table via
+ * a RESTful interface.
+ *
+ * @returns Koa router mounted at /api/admin/config
+ */
+export declare function createConfigRouter(): Router;
+//# sourceMappingURL=config.d.ts.map

package/dist/routes/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,yCAAyC;AACzC,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAEH,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAE7E;AAMD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAgH3C"}